konnektive-one@1.6.1
Konnektive / CheckoutChamp checkout engine — single-bundle (jQuery + sweetalert2). Load dist/engine.js with a data-config attribute pointing at your OPconfig.js.
AI Security Review
scanned 6h ago · by lpm-firewall-aiThe published entrypoint imports the bundled code containing a delayed, targeted browser disruption. This is concrete protestware behavior and warrants blocking.
Decision evidence
public snapshot- package.json names dist/engine.js as the package entrypoint.
- dist/engine.js imports the bundled SweetAlert2 code.
- The browser branch checks for Russian language settings and Russian or related host suffixes, then activates after the stored date is more than three days old.
- The branch disables page interaction and adds looping audio from flag-gimn.ru.
Source & flagged code
8 flagged · loading sourceBrowser source targets specific languages and host suffixes, disables page interaction, and automatically loops audio from a fixed external host.
dist/engine.jsView on unpkgA package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/engine.jsView on unpkgdist/engine.js imports the bundled SweetAlert2 code.
dist/engine.jsView on unpkg · L1278Findings
Affected versions and remediation
This report applies to konnektive-one@1.6.1.
See all versions of konnektive-one for other recorded verdicts.
- Avoid installing konnektive-one@1.6.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.